Threat Intelligence in SOC Operations, Incident Response, and Risk Management CTIA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC manager wants to measure whether threat intelligence is improving incident response times. Which metric is most appropriate?

   • ANumber of analysts trained on threat intelligence tools.
   • BTotal number of incidents handled per month.
   • CNumber of threat intelligence feeds integrated into the SIEM.
   • DMean time to detect (MTTD) and mean time to respond (MTTR) for incidents that involved threat intelligence.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization has separate SOC, IR, and risk teams. A new threat intelligence report is published that is relevant to all three teams. What is the most effective way to ensure all teams use the intelligence consistently?

   • AStore the report in a shared drive and assume all teams will read it.
   • BEmail the report to all teams and let each team interpret it independently.
   • CHave the SOC team implement all actions and inform the other teams after.
   • DHold a cross-functional briefing to discuss the report and agree on how each team will apply the intelligence.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A risk manager is prioritizing remediation efforts across multiple assets. Threat intelligence indicates that one asset is highly likely to be targeted by a specific adversary, but the asset has low business criticality. Another asset has lower threat likelihood but is business-critical. The risk manager must decide which asset to remediate first. Which decision is most aligned with risk management principles?

   • ARemediate both assets simultaneously with equal priority.
   • BPrioritize the business-critical asset because the impact of a compromise is higher, even though the threat likelihood is lower.
   • CPrioritize the highly targeted asset because the threat intelligence indicates a higher likelihood.
   • DDefer remediation of both assets until more threat intelligence is available.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization has multiple threat intelligence feeds from different vendors. The SOC team notices that some indicators are conflicting (e.g., one feed labels an IP as malicious, another as clean). The team wants to establish a process for consuming and updating intelligence. Which process should be implemented first?

   • AImmediately block all IPs flagged by any feed to ensure maximum security.
   • BUse the feed with the highest number of indicators and ignore the others.
   • CLet each SOC analyst decide which feed to trust on a case-by-case basis.
   • DDefine a centralized intelligence repository with a validation and scoring process to reconcile conflicting indicators before they are used in detection.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following best illustrates the use of threat intelligence in a threat hunting scenario?

   • AHunting for lateral movement patterns that match a known APT group's behavior
   • BRunning a vulnerability scan across the network
   • CReviewing firewall logs for denied connections
   • DUpdating the SIEM correlation rules
   Reveal Solution Discussion Select an answer first